Azure Bicep 创建 VM 时出现问题：“子网在虚拟网络中无效”

Question

任何想法为什么创建 Windows VM 的以下二头肌会抛出此错误。 NSG 已创建，但我看不到 VN 或 SN，并且 VM 创建会引发错误“子网 'sn-dwh-qa-02' 在虚拟网络 'vn-eastus-qa-01' 中无效”。我在开始时删除了一些参数定义。

param osVersion string = '2022-datacenter-azure-edition-core'

@description('Size of the virtual machine.')
param vmSize string = 'Standard_D2s_v3'

@description('Location for all resources.')
param location string = resourceGroup().location

@description('Name of the virtual machine.')
param vmName string

param os_storageAccountType string

param Disks array = []

param subnetName string = 'sn-dwh-qa-02' //TODO - Move to parameter call

param virtualNetworkName string = 'vn-eastus-qa-01' //TODO - Move to parameter call

@description('Provide virtual network resource group name to configure PrivateEndPoint')
param virtualNetworkResourceGroupName string

param storageBlobUri string = ''

@description('Tags to add to the resources')
param tags object = {}

@description('Commands to execute via VM extension')
param commandToExecute string = ''

@description('Private IP allocation method i.e. "Static" or "Dynamic"')
param privateIPAllocationMethod string = 'Dynamic'

@description('Private IP address of VM. This is required if privateIPAllocationMethod is "Dynamic"')
param privateIPAddresses array = []

param fileUris array = []

param networkSecurityGroupName string = 'vmdwhqa01-nsg' //TODO FIX

param addressPrefix string = '10.1.0.0/24' //TODO FIX

param subnetPrefix string = '255.255.255.0/24' //TODO - FIX '10.0.0.0/24'

var publicIpName = toLower('pip-${vmName}')

var nicName = toLower('nic-${vmName}')


resource pip 'Microsoft.Network/publicIPAddresses@2021-02-01' = if(!isPrivateIPOnly) {
  name: publicIpName
  location: location
  sku: {
    name: publicIpSku
  }
  properties: {
    publicIPAllocationMethod: publicIPAllocationMethod
    dnsSettings: {
      domainNameLabel: dnsLabelPrefix
    }
  }
}

resource securityGroup 'Microsoft.Network/networkSecurityGroups@2021-02-01' = {
  name: networkSecurityGroupName
  location: location
  properties: {
    securityRules: [
      {
        name: 'default-allow-3389'
        properties: {
          priority: 1000
          access: 'Allow'
          direction: 'Inbound'
          destinationPortRange: '3389'
          protocol: 'Tcp'
          sourcePortRange: '*'
          sourceAddressPrefix: '*'
          destinationAddressPrefix: '*'
        }
      }
    ]
  }
}

resource vn 'Microsoft.Network/virtualNetworks@2021-02-01' = {
  name: virtualNetworkName
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        addressPrefix
      ]
    }
    subnets: [
      {
        name: subnetName
        properties: {
          addressPrefix: subnetPrefix
          networkSecurityGroup: {
            id: securityGroup.id
          }
        }
      }
    ]
  }
}

var noOfPrivateIPAddresses = (length(privateIPAddresses) == 0) ? 1 : length(privateIPAddresses)

resource nic 'Microsoft.Network/networkInterfaces@2021-02-01' = {
  name: nicName
  location: location
  properties: {
    ipConfigurations: [for i in range(0, noOfPrivateIPAddresses): {
        name: 'ipconfig${(i + 1)}'
        properties: {
          privateIPAllocationMethod: privateIPAllocationMethod
          privateIPAddress: (toLower(privateIPAllocationMethod) == 'static' ) ? privateIPAddresses[i] : null
          primary: (i == 0 ) ? true : false
          publicIPAddress: ((!isPrivateIPOnly) ? true : false) ? {
            id: pip.id
          } : null
          subnet: {
            name: subnetName
            id: vn.id
            //id: resourceId(virtualNetworkResourceGroupName, 'Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, subnetName)
            //id: resourceId('Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, subnetName)
          }
        }
      }]
    
  }
}

我尝试过弄乱子网 - 我不是网络工程师，我是 Azure 开发人员，因为没有其他人对此一无所知，所以将其转储给了他们。可能是权限问题，因为当我在脚本运行后进入 GUI 并在其中创建虚拟机时，NSG 存在，但下拉列表中 VN 或 SN 都不可用。

Answer 1

“子网在虚拟网络中无效”：

当提供的子网地址前缀超出虚拟网络地址前缀范围时，会出现上述错误。

感谢@Thomas 指出了正确的方向。如果您的 vnet 地址前缀空间为

10.1.0.0/ 24

，则它由从

10.1.0.0

到

10.1.0.255

的可用 Ip 组成。这意味着您只能拥有一个子网，因为子网的大小可以相同，

10.1.0.0/24

。但是，它可以降低

10.1.0.0/25

、

10.1.0.0/26

和

10.1.0.0/32

。

确保您的子网地址前缀位于给定虚拟网络地址空间的范围内。

此外，当您尝试在虚拟网络下创建子网时，请使用

Microsoft.Network/virtualNetworks/subnets

资源以避免冲突。

下面是修改后的代码，并且能够成功部署，如图所示。

param osVersion string = '2022-datacenter-azure-edition-core'

@description('Size of the virtual machine.')
param vmSize string = 'Standard_D2s_v3'

@description('Location for all resources.')
param location string = resourceGroup().location

@description('Name of the virtual machine.')
param vmName string = 'newvmjah'


param Disks array = []

param subnetName string = 'sn-dwh-qa-02' //TODO - Move to parameter call

param virtualNetworkName string = 'vn-eastus-qa-01' //TODO - Move to parameter call

@description('Provide virtual network resource group name to configure PrivateEndPoint')
param virtualNetworkResourceGroupName string = 'xxxx'

param storageBlobUri string = ''
@description('Commands to execute via VM extension')
param commandToExecute string = ''

@description('Private IP allocation method i.e. "Static" or "Dynamic"')
param privateIPAllocationMethod string = 'Dynamic'

@description('Private IP address of VM. This is required if privateIPAllocationMethod is "Dynamic"')
param privateIPAddresses array = []

param fileUris array = []

param networkSecurityGroupName string = 'vmdwhqa01-nsg' //TODO FIX

param addressPrefix string = '10.1.0.0/24' //TODO FIX

param subnetPrefix string = '10.1.0.0/24' //TODO - FIX '10.0.0.0/24'

var publicIpName = toLower('pip-${vmName}')

var nicName = toLower('nic-${vmName}')


resource pip 'Microsoft.Network/publicIPAddresses@2021-02-01' = {
  name: publicIpName
  location: location
  sku: {
    name: 'Standard'
  }
  properties: {
    publicIPAllocationMethod: 'Static'
  }
}

resource securityGroup 'Microsoft.Network/networkSecurityGroups@2021-02-01' = {
  name: networkSecurityGroupName
  location: location
  properties: {
    securityRules: [
      {
        name: 'default-allow-3389'
        properties: {
          priority: 1000
          access: 'Allow'
          direction: 'Inbound'
          destinationPortRange: '3389'
          protocol: 'Tcp'
          sourcePortRange: '*'
          sourceAddressPrefix: '*'
          destinationAddressPrefix: '*'
        }
      }
    ]
  }
}

resource vn 'Microsoft.Network/virtualNetworks@2021-02-01' = {
  name: virtualNetworkName
  location: location
  properties: {
    addressSpace: {
      addressPrefixes: [
        addressPrefix
      ]
     }
     subnets: [
      {
        name: subnetName
        properties: {
          addressPrefix: subnetPrefix
          networkSecurityGroup: {
            id: securityGroup.id
          }
        }
      }
    ]
  }
}
resource subnetPbdResource 'Microsoft.Network/virtualNetworks/subnets@2021-02-01' = {
  name: subnetName
  parent: vn
  properties: {
    addressPrefix: subnetPrefix
  }
}

var noOfPrivateIPAddresses = (length(privateIPAddresses) == 0) ? 1 : length(privateIPAddresses)

resource nic 'Microsoft.Network/networkInterfaces@2021-02-01' = {
  name: nicName
  location: location
  properties: {
    ipConfigurations: [for i in range(0, noOfPrivateIPAddresses): {
        name: 'ipconfig${(i + 1)}'
        properties: {
          privateIPAllocationMethod: privateIPAllocationMethod
          privateIPAddress: (toLower(privateIPAllocationMethod) == 'static' ) ? privateIPAddresses[i] : null
          primary: (i == 0 ) ? true : false
          publicIPAddress: {
            id: pip.id
          }
          subnet: {
            name: subnetName
            id: resourceId(virtualNetworkResourceGroupName, 'Microsoft.Network/virtualNetworks/subnets', virtualNetworkName, subnetName)
          }
        }
      }]
    
  }
}

部署成功：